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STATEMENT OF CASE 
Appellants appeal under 35 U.S.C. § 134(a) from a final rejection of 
claims 1-6, 8-1 1, 14, 15, 17-20, and 23-26. 1 We have jurisdiction under 35 
U.S.C. § 6(b). We reverse. 

Exemplary Claim 
Exemplary independent claim 1 under appeal, with emphasis and 
paragraphing added, reads as follows: 

1. Apparatus for empirically adjusting a user's authorized access to a 
database, said apparatus comprising: 

coupled to the database, a database discovery module configured to 
determine database structure and the user's authorized access to the 
database, the user's authorized access including a set of authorized database 
tables and authorized columns; 

coupled to the database, a command monitoring module configured to 
monitor the user's actual accesses to the database until a preselected quantity 
of actual accesses have been observed, the user's actual accesses including a 
set of accessed database tables and accessed columns; and 

coupled to the database discovery module and to the command 
monitoring module, an analysis module configured to compare the user y s 
actual accesses with the user 's authorized access and configured to adjust 
the user 's authorized access taking into account results of the comparing by 
changing settings within a database access control module to deny the user 
future database access to an authorized database table or an authorized 
column that is not in the set of accessed database tables and accessed 
columns. 



1 Claims 7, 12, 13, 16, 21, and 22 have been canceled. 
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The Examiner 's Rejections 

(1) The Examiner rejected claims 1-4 and 23 under 35 U.S.C. § 101 as 
being directed to non-statutory subject matter (see Final Rej. 2). Because 
the Examiner has not maintained the rejection of claims 1-4 and 23 under 35 
U.S.C. § 101 in the Answer (see generally Ans. 3-17), and indicates 
agreement (see Ans. 2, | (6)) with Appellants' statement of the grounds of 
rejection to be reviewed on appeal (App. Br. 5, listing only the three 

§ 103(a) rejections infra), we consider this rejection to be withdrawn and do 
not reach the merits or otherwise review this rejection in our decision. 

(2) The Examiner rejected claims 1-3, 5, 8, 9, 11, 14, 17, 18, 20, and 
23-26 as being unpatentable under 35 U.S.C. § 103(a) over Mattson (US 
2003/0101355 Al) and Ludwig (US 2003/0167229 Al). Ans. 4-10. 

(3) The Examiner rejected claims 4, 10, and 19 as being unpatentable 
under 35 U.S.C. § 103(a) over Mattson, Ludwig, and Wai Lup Low, et al, 
DIDAFIT:DETECTION INTRUSIONS IN DATABASES THROUGH 
FINGERPRINTING TRANSACTIONS, ICEIS 2002 - Databases and 
Information Systems Integration, pp. 121-128 (2002) (hereinafter, 
"Low"). Ans. 10-11. 

(4) The Examiner rejected claims 6 and 15 as being unpatentable 
under 35 U.S.C. § 103(a) over Mattson, Ludwig, and Vaitzblit (US 
2005/0097149 Al). Ans. 11-12. 

Appellants ' Contentions 
Appellants contend (App. Br. 5-9; Reply Br. 2-3), inter alia, that the 
Examiner erred in rejecting claims 1-6, 8-11, 14, 15, 17-20, and 23-26 under 
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35 U.S. C. § 103(a) because Mattson and Ludwig, taken singly or in 
combination, fail to disclose adjusting a user's authorized access by 
"deny[ing] the user future database access to an authorized database table or 
an authorized column that is not in the set of accessed database tables and 
accessed columns/' as set forth in claim 1. 

Appellants also contend (App. Br. 7-8; Reply Br. 3) that the Examiner 
erred in rejecting claim 1 because Ludwig (| [0051]) discloses expiring 
inactive accounts, and does not teach or suggest denying future database 
access to "authorized database table or an authorized column that is not in 
the set of accessed database tables and accessed columns" (claim 1) 
(emphasis added). 

Issue on Appeal 

Based on Appellants' arguments, the following pivotal issue is 
presented on appeal: 

Did the Examiner err in rejecting claims 1-6, 8-1 1, 14, 15, 17-20, and 
23-26 as being obvious because the combination of Mattson and Ludwig 
fails to teach or suggest "deny[ing] the user future database access to an 
authorized database table or an authorized column that is not in the set of 
accessed database tables and accessed columns," as set forth in claims 1, 5, 
and 14 on appeal? 



2 We recognize that Appellants' arguments present additional issues. Many 
of the arguments presented by the additional issues are not persuasive; 
nonetheless we were persuaded of error by this issue and as such we do not 
reach the additional issues as this issue is dispositive of the appeal. 
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ANALYSIS 

We have reviewed the Examiner's rejections in light of Appellants' 
arguments in the Appeal Brief (App. Br. 5-10) and Reply Brief (Reply Br. 2- 
5) that the Examiner has erred. We agree with Appellants' conclusion 
specifically listed above. 

The Examiner asserts that Mattson discloses adjusting a user's 
authorized accesses to an authorized database table or an authorized column, 
and admits that Mattson "does not explicitly teach adjusting the user's 
authorization to deny future access to authorized tables/columns that were 
previously authorized, but not accessed" (Ans. 5 (citing Mattson at fflf [0038] 
and [0046])). The Examiner determines that "Ludwig teaches a modular 
business transactions platform (see abstract), in which he teaches denying 
future access to authorized tables/columns that were previously authorized, 
but not accessed (paragraph 51)" (Ans. 5 and 7). The Examiner also 
determines that Ludwig "deniefs] access to previously authorized database 
tables/columns, such as those handled by a host user in paragraph 44" (Ans. 
5 and 7). 

However, our close review of Ludwig's paragraphs [0044] and [0051] 
reveals that Ludwig merely describes users having different levels of 
permission, database administration, and monitoring system activity 
(1 [0044]), as well as disabling or expiring an inactive user account "after a 
certain number of days of nonuse" (1 [005 1]). Ludwig fails to teach 
authorized database tables or columns that are not in the set of accessed 
database tables and accessed columns, as set forth in claims 1, 5, and 14. 
Although Ludwig disallows or denies access, Ludwig is silent as to 
"deny[ing] the user future database access to an authorized database table or 
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an authorized column that is not in the set of accessed database tables and 
accessed columns," as set forth in claims 1, 5, and 14. Ludwig's paragraph 
[0044] fails to teach or suggest authorized database tables or columns being 
present in the database or system. 

Mattson does disclose authorized rows and columns of a table 
(1 [0035]), and authorized table columns (1 [0038]). However, Mattson still 
does not teach or suggest "an authorized database table or an authorized 
column that is not in the set of accessed database tables and accessed 
columns," as recited in claims 1, 5, and 14. 

We are persuaded by Appellants' argument that the Examiner has not 
shown that Mattson and Ludwig, taken singly or in combination, disclose 
adjusting a user's authorized access by denying the user future database 
access to an authorized database table or an authorized column that is not in 
the set of accessed database tables and accessed columns as claimed. 
Accordingly, we will not sustain the Examiner's rejection of independent 
claims 1,5, and 14 over the combination of Mattson and Ludwig, as well as 
claims 2, 3, 8, 9, 11, 17, 18, 20, and 23-26 which ultimately depend 
respectively therefrom. 

For similar reasons, and because Low and Vaitzblit fail to cure the 
deficiencies of Mattson and Ludwig, we will also not sustain the Examiner's 
rejections (i) claims 4, 10, and 19 over Mattson, Ludwig, and Low; and (ii) 
claims 6 and 15 over Mattson, Ludwig, and Vaitzblit. 

CONCLUSION 

Appellants have demonstrated that the Examiner erred in rejecting 
claims 1-6, 8-1 1, 14, 15, 17-20, and 23-26 as being unpatentable under 
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35 U.S.C. § 103(a) because Mattson and Ludwig, taken individually or in 
combination, fail to teach or suggest "deny[ing] the user future database 
access to an authorized database table or an authorized column that is not in 
the set of accessed database tables and accessed columns," as recited in 
claims 1, 5, and 14. 

DECISION 

The Examiner's § 103(a) rejections of claims 1-6, 8-11, 14, 15, 17-20, 
and 23-26 are reversed. 

REVERSED 



msc 



7 



